How to decode 2 wire RS232 on an undocumented device

[K1JOS]

I have a motor controller that I cannot obtain the specs.  It controls a 5vdc 5A DC motor.  There is a hand remote going to the controller (hardwired- 5v, GND, A,B) has two momentary membrane switches - one for clockwise rotation and the other for counterclockwise.  The hardwired remote (10foot coiled shielded) has a PIC18 and communicates to the controller (also has PIC18) via a MAX483 using two wires only.  I assume the PIC on the remote is used only to debounce the switches plus monitor for inadvertent pressing of both buttons simultaneously.  Functionally all communications would need to be one-way from remote to the controller

I am trying to replace the hardwired remote with a Moteino wireless solution.  My first crack at this is to decode the hardwired remote RS232 to seem if I can figure out the few command codes.  I have an Agilent 3000x and have seen the shortest pulse duration is 100us so I figure the baud rate is 9600. 

When the remote is idle (no buttons pressed) the signals on the two wires show identical patterns only one is inverted from the other.

I assume that in this application, the communication is all one direction --- remote to controller??  How would I determine which wire is RX and TX ?  Any shortcuts other than trying every combination to figure out the # of bits and parity and the polarity of the bit order?

Many thanks in advance for any help.

jerry

[sporadic]

Sounds like RS485, not 232. Those are differential signals you're seeing.

[K1JOS]

Wouldn't RS485 need two pairs (4-wire)?  But maybe since this is most likely only sending from the remote to controller maybe one pair.  IS there a way to decode the 2 wire RS485 on the scope? 

[digsys]

Wouldn't RS485 need two pairs (4-wire)?  But maybe since this is most likely only sending from the remote to controller maybe one pair.  IS there a way to decode the 2 wire RS485 on the scope?

Not necessarily. You can have both Rxd and Txd share the same 2 wires. In this case the bus is "floating",
tied H and L with resitors and a termination.
EASIEST way to get a start is to use an RS485 to TTL (or RS232) converter chip on the "bus" and send everything
to a PC RS232 monitor program. Then you can work out baud rates, data and direction.
There are many ic's that could do the job, as you are only listening.

[kolbep]

Get a max483 (3.3v) or a max485 (5v) rs485 interface chip. Connect it so that the 2 wires of the system also go into the input on this chip then you can scope the output of the chip.

or get the max483 datasheet, identify which pin is driven form the microcontroller in the remote, or which pin drives the micro in the receiver, and scope that pin.

another way to tap this bus, because it only has 2 devices anyway, is to put an opto isolator's led with a resistor, across those 2 lines, and then you can do whatever you need to, to examine the comms.

but get the maxim max483 or 485 datasheet. It will help a lot

[Wilksey]

RS485 is typically 2 wire, RS422 is 2 or 4 wire.

If you get an RS485 -> USB converter you can multidrop the RS485 and see what is going on.
If the device is not designed to be multidrop it should have a termination resistor on one of the ends somewhere.

[miceuz]

Check datasheet for PIC18, find which pins are TX and RX, check datasheet for MAX48* chip, find which pins are input/output and if direction pin is used. You might gain insight who talks to who. Then you can scope directly on TX/RX pins of microcontrollers. The easiest thing to do would be just grab any cheapo USB-UART converter, hook it up to TX pin of the remote  and record data to a PC. The analyse.

[sporadic]

Wouldn't RS485 need two pairs (4-wire)?  But maybe since this is most likely only sending from the remote to controller maybe one pair.  IS there a way to decode the 2 wire RS485 on the scope?

Just two wire as others said.  A & B are your differential pairs and the setup would be half-duplex for communication.  You can probably just probe either A or B unless you're at the end of a long run with some noise.  Then you can probe A on CH1, B on CH2, and subtract them to get the differential signal.  Or as others have said, probe the otherside of the RS485 transceiver itself.

As for decoding you could probably tap the line as others have said, run the remote straight to a RS485 USB dongle and capture, use a logic analyzer, or just count the bits on your scope.

For example, below is the letter 'U' (0x55 - 01010101) being transmitted.
The yellow trace (CH1) is the A line.
The blue trace (CH2) is the B line.
The purple is a differential (B-A) of the two.


rs485_SN65LBC179P by smerrick, on Flickr

I've written up some stuff on avoiding cheap RS485 dongles here if interested.  Performance can be dodgy at best on some of them.

[onlooker]

Could you just have the receiver end of your wireless solution emulate the button press on the hardwired remote? This way, you would not need to know the comm protocol.

[K1JOS]

thank you to all for the many tips how to start to approach this.  I am looking at the datasheets for the MAX483 and PIC18F to see if I can make sense of what the two lines are.  The PIC18F seems to have 5 pairs of pins for I/O and I think it is arbitrary which pin in each pair the designer chooses for the 485 function.  Function is handled in code.  In my device, the remote PIC sends its signals to a MAX483 on the remote PCB and this comes right out as two wires so it may be easiest for me to breadboard a RS48x - USB chip... but I will still have the problem of not knowing which of the two wires is doing what.  I will try to observe the differential signal on my scope and see how that looks.  I assume that when no buttons are bneing pressed, the data packet from the remote to the control board is constant so that should simplifiy things for me.  I will read more on the MAX483 half-duplex.  Hope you can help more here

jerry

[miceuz]

you are looking at ONE signal that is carried as a differential signal on two wires. when one wire goes high, another goes low and vice versa.

disconnect the remote and scope the connecto on the device - is the signal still there? If so, the device might be polling the remote. Also, try powering the remote separately and scoping it's output - if signal is there, the remote is just sending it's status constantly to the device, hopefully without any hand-shaking - this would be a win.

EDIT:
Also you can scope DI and RO pins on the remote and on the device.  Microcontroller uses DI pin to send data and RO pin to listen to data. You can determine who talks and who listens by scoping these pins.

[K1JOS]

I did some further snooping.  I removed the remote and looked at the base station end only and found the remote two wires input were connected to the MAX483 at pins 6 and 7.  I borrowed a friends Agilent 1141A differential probe and hooked it up to these pins without the remote connected and tried various RS232 decode settings (all triggered on TX start).  The fewest errors were with Baud 9600, 8 bits, No parity.  With this I see that the base station is sending a constant repeating HEX pattern in the decode list:

Unknown TX error
3F
47
E6
EE
(blank)

and then the entire sequence repeats.  I tried other decode RS232 settings and bit orders and these gave more decode errors.

I next looked at the remote alone by powering it with its needed 5vdc and the scope only shows a constant +2V differential with no signals.  I tried pressing the two membrane switches on the remote and still no signals on the scope.

Am I correct that it seems the base controller is sending a 'heartbeat' that the remote needs before acting?

I will now hook the remote back to the base station and see how the decodes look different all wired together.

Does it sound like I got the differential decode right or should this be done a different way??

many thanks to all for advice.

jerry

[K1JOS]

PROGRESS !!

I did more reading on RS232/RS484 and with the differential probe it looks like I had the serial decode idle polarity set wrong.  With idle polarity high and bit order LSB I get no decode errors.  Now with the remote connected to the base station I get the following decodes (triggering on Start bit):

Code: [Select]

// when idle
02 88 31 00 04

//with remote motor switch pressed for clockwise rotation
02 88 31 08 04

//with remote motor switch pressed for counterclockwise rotation
02 88 31 06 04
 So I believe I now can begin thinking how to replace the hardwired remote with my wireless remote Moteino replicating the motor codes. 

With this being half duplex bidirectional two wire, I don't understand how collisions are avoided.  I searched to trigger on XON or XOFF but could not find any in the serial stream.   It seems that the base station sends out a heartbeat continuously and the remote will not send anything unless it sees the heartbeat on the RS485 bus.  So my assumption is the 'idle' decode all comes from the base station while the motor codes are all from the remote.  What prevents collisions when remote transmits on the same 2 wires  on top of the base station signals?